{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-41415", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2025-07-31T16:41:30.376Z", "datePublished": "2025-08-21T19:57:26.099Z", "dateUpdated": "2025-08-21T20:13:40.413Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "PI Integrator", "vendor": "AVEVA", "versions": [{"lessThan": "2020 R2 SP1", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Maxime Escourbiac, Michelin CERT, and Adam Bertrand, Abicom for Michelin CERT reported these vulnerabilities to AVEVA."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The vulnerability, if exploited, could allow an authenticated miscreant \n(with privileges to access publication targets) to retrieve sensitive \ninformation that could then be used to gain additional access to \ndownstream resources."}], "value": "The vulnerability, if exploited, could allow an authenticated miscreant \n(with privileges to access publication targets) to retrieve sensitive \ninformation that could then be used to gain additional access to \ndownstream resources."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 7.1, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-201", "description": "CWE-201", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2025-08-21T19:57:26.099Z"}, "references": [{"url": "https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2025-004.pdf"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-224-04"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>AVEVA recommends organizations evaluate the impact of these \nvulnerabilities based on their operational environment, architecture, \nand product implementation. Users of affected product versions should \napply security updates to mitigate the risk of exploit.</p>\n<ul>\n<li>Upgrade to PI Integrator for Business Analytics 2020 R2 SP2 or higher.</li>\n<li>From [OSISoft Customer Portal](PI Integrator for Business \nAnalytics), search for \"PI Integrator for Business Analytics\" and select\n version 2020 R2 SP2 or higher.</li>\n</ul>\n\n<br>"}], "value": "AVEVA recommends organizations evaluate the impact of these \nvulnerabilities based on their operational environment, architecture, \nand product implementation. Users of affected product versions should \napply security updates to mitigate the risk of exploit.\n\n\n\n * Upgrade to PI Integrator for Business Analytics 2020 R2 SP2 or higher.\n\n * From [OSISoft Customer Portal](PI Integrator for Business \nAnalytics), search for \"PI Integrator for Business Analytics\" and select\n version 2020 R2 SP2 or higher."}], "source": {"advisory": "ICSA-25-224-04", "discovery": "EXTERNAL"}, "title": "AVEVA PI Integrator Insertion of Sensitive Information into Sent Data", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Additionally, AVEVA recommends the following general defensive measures:</p>\n<ul>\n<li>Audit assigned permissions to ensure that only trusted users are given access rights to publication targets: <a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.aveva.com/bundle/pi-integrator-for-business-analytics/page/1013185.html\">https://docs.aveva.com/bundle/pi-integrator-for-business-analytics/page/1013185.html</a></li></ul><li>Ensure\n publication targets of type Text File or HDFS are configured to limit \nallowed output file extensions and limit output folders to be logically \nisolated from critical system components or executable paths:</li>\n<li><a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.aveva.com/bundle/pi-integrator-for-business-analytics/page/1023019.html\">https://docs.aveva.com/bundle/pi-integrator-for-business-analytics/page/1023019.html</a></li><a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.aveva.com/bundle/pi-integrator-for-business-analytics/page/1023019.html\">https://docs.aveva.com/bundle/pi-integrator-for-business-analytics/page/1023009.html</a>Consider applying Windows Defender Application Control (WDAC) to prevent execution of unauthorized executables: <a target=\"_blank\" rel=\"nofollow\" href=\"https://learn.microsoft.com/en-us/intune/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager\">https://learn.microsoft.com/en-us/intune/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager</a>\n\n<br>"}], "value": "Additionally, AVEVA recommends the following general defensive measures:\n\n\n\n * Audit assigned permissions to ensure that only trusted users are given access rights to publication targets: https://docs.aveva.com/bundle/pi-integrator-for-business-analytics/page/1013185.html \n\n\n * Ensure\n publication targets of type Text File or HDFS are configured to limit \nallowed output file extensions and limit output folders to be logically \nisolated from critical system components or executable paths:\n\n * https://docs.aveva.com/bundle/pi-integrator-for-business-analytics/page/1023019.html \n https://learn.microsoft.com/en-us/intune/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager"}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-21T20:13:29.628004Z", "id": "CVE-2025-41415", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-21T20:13:40.413Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-41415", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-21T20:13:29.628004Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-21T20:13:36.367Z"}}], "cna": {"title": "AVEVA PI Integrator Insertion of Sensitive Information into Sent Data", "source": {"advisory": "ICSA-25-224-04", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Maxime Escourbiac, Michelin CERT, and Adam Bertrand, Abicom for Michelin CERT reported these vulnerabilities to AVEVA."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "AVEVA", "product": "PI Integrator", "versions": [{"status": "affected", "version": "0", "lessThan": "2020 R2 SP1", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "AVEVA recommends organizations evaluate the impact of these \nvulnerabilities based on their operational environment, architecture, \nand product implementation. Users of affected product versions should \napply security updates to mitigate the risk of exploit.\n\n\n\n * Upgrade to PI Integrator for Business Analytics 2020 R2 SP2 or higher.\n\n * From [OSISoft Customer Portal](PI Integrator for Business \nAnalytics), search for \"PI Integrator for Business Analytics\" and select\n version 2020 R2 SP2 or higher.", "supportingMedia": [{"type": "text/html", "value": "<p>AVEVA recommends organizations evaluate the impact of these \nvulnerabilities based on their operational environment, architecture, \nand product implementation. Users of affected product versions should \napply security updates to mitigate the risk of exploit.</p>\n<ul>\n<li>Upgrade to PI Integrator for Business Analytics 2020 R2 SP2 or higher.</li>\n<li>From [OSISoft Customer Portal](PI Integrator for Business \nAnalytics), search for \"PI Integrator for Business Analytics\" and select\n version 2020 R2 SP2 or higher.</li>\n</ul>\n\n<br>", "base64": false}]}], "references": [{"url": "https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2025-004.pdf"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-224-04"}], "workarounds": [{"lang": "en", "value": "Additionally, AVEVA recommends the following general defensive measures:\n\n\n\n * Audit assigned permissions to ensure that only trusted users are given access rights to publication targets: https://docs.aveva.com/bundle/pi-integrator-for-business-analytics/page/1013185.html \n\n\n * Ensure\n publication targets of type Text File or HDFS are configured to limit \nallowed output file extensions and limit output folders to be logically \nisolated from critical system components or executable paths:\n\n * https://docs.aveva.com/bundle/pi-integrator-for-business-analytics/page/1023019.html \n https://learn.microsoft.com/en-us/intune/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager", "supportingMedia": [{"type": "text/html", "value": "<p>Additionally, AVEVA recommends the following general defensive measures:</p>\n<ul>\n<li>Audit assigned permissions to ensure that only trusted users are given access rights to publication targets: <a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.aveva.com/bundle/pi-integrator-for-business-analytics/page/1013185.html\">https://docs.aveva.com/bundle/pi-integrator-for-business-analytics/page/1013185.html</a></li></ul><li>Ensure\n publication targets of type Text File or HDFS are configured to limit \nallowed output file extensions and limit output folders to be logically \nisolated from critical system components or executable paths:</li>\n<li><a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.aveva.com/bundle/pi-integrator-for-business-analytics/page/1023019.html\">https://docs.aveva.com/bundle/pi-integrator-for-business-analytics/page/1023019.html</a></li><a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.aveva.com/bundle/pi-integrator-for-business-analytics/page/1023019.html\">https://docs.aveva.com/bundle/pi-integrator-for-business-analytics/page/1023009.html</a>Consider applying Windows Defender Application Control (WDAC) to prevent execution of unauthorized executables: <a target=\"_blank\" rel=\"nofollow\" href=\"https://learn.microsoft.com/en-us/intune/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager\">https://learn.microsoft.com/en-us/intune/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager</a>\n\n<br>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The vulnerability, if exploited, could allow an authenticated miscreant \n(with privileges to access publication targets) to retrieve sensitive \ninformation that could then be used to gain additional access to \ndownstream resources.", "supportingMedia": [{"type": "text/html", "value": "The vulnerability, if exploited, could allow an authenticated miscreant \n(with privileges to access publication targets) to retrieve sensitive \ninformation that could then be used to gain additional access to \ndownstream resources.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-201", "description": "CWE-201"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2025-08-21T19:57:26.099Z"}}}, "cveMetadata": {"cveId": "CVE-2025-41415", "state": "PUBLISHED", "dateUpdated": "2025-08-21T20:13:40.413Z", "dateReserved": "2025-07-31T16:41:30.376Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2025-08-21T19:57:26.099Z", "assignerShortName": "icscert"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The vulnerability, if exploited, could allow an authenticated miscreant \n(with privileges to access publication targets) to retrieve sensitive \ninformation that could then be used to gain additional access to \ndownstream resources."}, {"lang": "es", "value": "La vulnerabilidad, si se explota, podr\u00eda permitir que un malhechor autenticado (con privilegios para acceder a los objetivos de publicaci\u00f3n) recupere informaci\u00f3n confidencial que luego podr\u00eda usarse para obtener acceso adicional a recursos posteriores."}], "id": "CVE-2025-41415", "lastModified": "2025-08-22T18:08:51.663", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}, "published": "2025-08-21T20:15:33.053", "references": [{"source": "ics-cert@hq.dhs.gov", "url": "https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2025-004.pdf"}, {"source": "ics-cert@hq.dhs.gov", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-224-04"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-201"}], "source": "ics-cert@hq.dhs.gov", "type": "Primary"}]}

{}